@coder/ai-sdk-sandbox 0.4.1 → 0.4.3

package/README.md

@@ -246,17 +246,181 @@ Esc or Ctrl+C).
 
 Because the bridge runs inside the workspace, the workspace image must have:
 
-- **Node.js** (the docs use `node24`). The bridge is `node bridge.mjs`.
-- **pnpm** available on PATH (e.g. via `corepack enable`) — the adapter uses it to
-  bootstrap the bridge.
-- **Outbound network access** to the npm registry (the adapter `pnpm install`s
-  the bridge's dependencies + the Claude Code CLI on first use) and to the model
-  API (`api.anthropic.com` for Claude Code, `api.openai.com` for Codex). Bake the
-  dependencies into the image to avoid per-session installs.
+- **Node.js ≥ 22** on the login-shell PATH. The bridge is `node bridge.mjs`, the
+  native transport's relay is `node -e`, and the pinned
+  `@anthropic-ai/claude-code` bridge dependency requires Node 22+.
+- **pnpm** on the login-shell PATH (e.g. `npm install -g pnpm`) — the adapter's
+  bootstrap runs `pnpm install --frozen-lockfile` to install the bridge's
+  dependencies.
+- **Outbound network access** to the npm registry (the bootstrap downloads the
+  bridge's dependencies — including the Claude Code CLI's ~250 MB platform
+  binary, which ships as an npm package — on first use) and to the model API
+  (`api.anthropic.com` for Claude Code, `api.openai.com` for Codex). Pre-bake
+  the bootstrap into the image to skip the registry entirely — see
+  [Template authoring](#template-authoring-zero-install-sessions).
 - **The model API key** available to the bridge — `ANTHROPIC_API_KEY` /
   `OPENAI_API_KEY`. Configure it through the adapter's `auth` option or ensure it
   is present in the workspace environment.
-- `bash` and `base64` (standard on any Linux dev image).
+- `bash` and `base64` (remote commands run through `bash -lc`; file I/O is
+  base64-encoded), plus `stty` for the native transport's relay bootstrap. All
+  standard on any Linux dev image.
+
+## Template authoring: zero-install sessions
+
+How to build a Coder template whose workspaces start harness sessions with
+**zero runtime install latency**. Generic template authoring is covered by the
+[Coder template docs](https://coder.com/docs/admin/templates) and
+[Coder's example Docker template](https://github.com/coder/coder/tree/main/examples/templates/docker);
+this section covers only the ai-sdk-specific delta. A validated
+Dockerfile + `main.tf` pair lives in [`examples/template/`](./examples/template/).
+
+### What the first session installs
+
+On the first session in a fresh workspace, the Claude Code adapter applies its
+bootstrap recipe relative to the session's default working directory (`$HOME`
+for this provider):
+
+1. It writes `package.json`, `pnpm-lock.yaml`, and `bridge.mjs` (assets shipped
+   inside `@ai-sdk/harness-claude-code`) to `~/.harness-bootstrap/claude-code/`.
+2. It runs `pnpm install --frozen-lockfile --store-dir .pnpm-store` there. This
+   is the expensive step: ~300 MB from the npm registry — the bridge
+   dependencies include the `@anthropic-ai/claude-code` platform binary — taking
+   tens of seconds to minutes depending on the network.
+3. It runs the CLI's `install.cjs` (links the platform binary npm delivered; no
+   extra download) and `./node_modules/.bin/claude --version`.
+4. It writes a `.bootstrap-<recipe-hash>.ok` marker next to them. Later sessions
+   see the marker and skip all of the above — a single file read.
+
+Zero-install means baking the results of steps 1–3 into the image **at that
+exact path**. The first session in each workspace then replays the recipe as a
+fast offline no-op (~4 s measured; pnpm prints `Already up to date` and
+downloads nothing) and writes the marker; every session after that is a single
+file read.
+
+### Step 1 — Dockerfile: pre-bake the bootstrap
+
+[`examples/template/Dockerfile`](./examples/template/Dockerfile) installs the
+[workspace requirements](#workspace-requirements) (Node 24 + pnpm on PATH,
+bash/coreutils) and replays the recipe at build time — same files, same
+commands, same absolute path:
+
+```dockerfile
+ARG HARNESS_CLAUDE_CODE_VERSION=1.0.90
+RUN mkdir -p /home/${USER}/.harness-bootstrap/claude-code \
+  && cd /tmp \
+  && npm pack @ai-sdk/harness-claude-code@${HARNESS_CLAUDE_CODE_VERSION} \
+  && tar -xzf ai-sdk-harness-claude-code-${HARNESS_CLAUDE_CODE_VERSION}.tgz \
+  && cp package/dist/bridge/package.json package/dist/bridge/pnpm-lock.yaml \
+    /home/${USER}/.harness-bootstrap/claude-code/ \
+  && cp package/dist/bridge/index.mjs \
+    /home/${USER}/.harness-bootstrap/claude-code/bridge.mjs \
+  && rm -rf package ai-sdk-harness-claude-code-${HARNESS_CLAUDE_CODE_VERSION}.tgz \
+  && cd /home/${USER}/.harness-bootstrap/claude-code \
+  && pnpm install --frozen-lockfile --store-dir .pnpm-store \
+  && node node_modules/@anthropic-ai/claude-code/install.cjs \
+  && ./node_modules/.bin/claude --version
+```
+
+Rules that make or break the pre-bake:
+
+- **Bake at the final absolute path.** pnpm records the store location as an
+  absolute path (in `node_modules/.modules.yaml`), so a cache baked at, say,
+  `/opt/...` and copied into `$HOME` later makes the session's `pnpm install`
+  abort (`ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY` — pnpm wants to purge and
+  reinstall, and a session has no TTY to confirm).
+- **Pin the adapter version your application resolves** (find it with
+  `pnpm why @ai-sdk/harness-claude-code`, or in your lockfile) and pass it as
+  `--build-arg HARNESS_CLAUDE_CODE_VERSION=...`. The recipe and its marker hash
+  derive from the adapter's shipped assets. A mismatch is not fatal — the
+  recipe re-runs in the same directory and downloads only the delta — but it
+  reintroduces registry traffic on first sessions.
+- **Build for the workspace CPU architecture** — the pre-bake fetches the
+  builder platform's `claude` binary.
+
+### Step 2 — main.tf: get the cache into the home volume
+
+[`examples/template/main.tf`](./examples/template/main.tf) is Coder's example
+Docker template minus the IDE modules, with three ai-sdk-specific choices:
+
+- **The workspace image is the pre-baked one** (`variable "image"`); push it to
+  a registry your Coder provisioners can pull from.
+- **`startup_script_behavior = "blocking"`** on `coder_agent`: this provider's
+  create mode waits for `lifecycle_state: ready` before the harness runs, and
+  blocking makes ready mean "startup script finished" (the attribute defaults to
+  `non-blocking`, in which case ready does not wait for the script).
+- **The home volume seeds itself from the image.** Docker populates a fresh
+  (empty) named volume with the image's content at the mount path, so
+  `/home/coder/.harness-bootstrap` lands in every new workspace's volume with no
+  startup-script copying. No port configuration is needed either: the provider
+  forwards the bridge port itself (OpenSSH `-L` or the native relay), not
+  through template port shares.
+
+For volume types that do _not_ copy image content (a Kubernetes PVC mounted at
+`/home/coder` shadows it with an empty filesystem), stash the bake outside the
+mount and restore it — at the same absolute path — on first start:
+
+```dockerfile
+# Dockerfile, after the pre-bake step:
+RUN sudo cp -a /home/${USER}/.harness-bootstrap /opt/harness-bootstrap-stash
+```
+
+```hcl
+  startup_script = <<-EOT
+    set -e
+    if [ ! -d ~/.harness-bootstrap ]; then
+      cp -a /opt/harness-bootstrap-stash ~/.harness-bootstrap
+    fi
+  EOT
+```
+
+(`cp -a` preserves the hardlinks between the pnpm store and `node_modules`, so
+the stash and the restore each stay ~300 MB rather than doubling.)
+
+Build, push, and point the provider at the template
+([creating templates](https://coder.com/docs/admin/templates/creating-templates)):
+
+```bash
+cd examples/template
+docker build -t <registry>/ai-sdk-sandbox-workspace:v1 .
+docker push <registry>/ai-sdk-sandbox-workspace:v1
+coder templates push ai-sdk-sandbox --variable image=<registry>/ai-sdk-sandbox-workspace:v1
+```
+
+```ts
+createCoderWorkspace({ create: { template: "ai-sdk-sandbox" } });
+```
+
+### Sizing
+
+Measured on the example image (linux/amd64): ~730 MB total — ~430 MB for
+Ubuntu 24.04 + Node 24 + pnpm, ~300 MB for the bootstrap cache (dominated by
+the pnpm store; `node_modules` hardlinks into it). Each workspace's home volume
+receives the ~300 MB seeded cache; leave headroom for per-session work
+directories (`claude-code-<sessionId>/`) and whatever your agents check out.
+
+### Verifying zero installs
+
+**Image-level (no Coder deployment needed).** Replay the bootstrap on a fresh
+volume with networking disabled — it must succeed offline:
+
+```bash
+docker volume rm -f probe-home && docker volume create probe-home
+docker run --rm --network none -v probe-home:/home/coder \
+  <image> bash -lc 'cd ~/.harness-bootstrap/claude-code \
+    && pnpm install --frozen-lockfile --store-dir .pnpm-store \
+    && node node_modules/@anthropic-ai/claude-code/install.cjs \
+    && ./node_modules/.bin/claude --version'
+```
+
+Expect `Already up to date` from pnpm and the CLI version banner in a few
+seconds — proof that a session's bootstrap needs no registry access.
+
+**Session-level.** After the first session against a workspace from the
+template, `~/.harness-bootstrap/claude-code/` must contain a `.bootstrap-*.ok`
+marker (later sessions skip the recipe entirely). If session creation instead
+stalls for minutes with pnpm download progress in the bootstrap, the image's
+pinned adapter version doesn't match the application's (see the pinning rule
+above).
 
 ## Settings
 
@@ -372,8 +536,6 @@ and a full Claude Code turn with tool use (`scripts/e2e-claude.ts`).
 
 - `setNetworkPolicy` is not implemented (omitted) — egress is governed by your
   Coder template/deployment, not this provider.
-- `bridgePorts` is intentionally left undefined: this provider binds one
-  workspace per session rather than leasing ports from a shared sandbox.
 - File reads buffer the whole file (binary content moves as base64). Fine for
   bootstrap-sized files; not intended for streaming very large files.
 - `CoderNativeTransport` currently targets POSIX workspaces with `bash`, `stty`,
@@ -383,9 +545,11 @@ and a full Claude Code turn with tool use (`scripts/e2e-claude.ts`).
   native transport refuses to guess.
 - `@ai-sdk/sandbox-just-bash` cannot expose ports and is rejected by bridge-backed
   adapters — this provider exists precisely to provide that port.
-- To run Claude Code / Codex, the **workspace** image needs Node.js (the adapter
-  installs the bridge + CLI on first use) and egress to the npm registry and the
-  model API. Provide the API key via the adapter's `auth` option.
+- To run Claude Code / Codex, the **workspace** image needs Node.js ≥ 22 (the
+  adapter installs the bridge + CLI on first use) and egress to the npm registry
+  and the model API — unless the image pre-bakes the bootstrap (see
+  [Template authoring](#template-authoring-zero-install-sessions)). Provide the
+  API key via the adapter's `auth` option.
 
 ## Development
 

package/dist/index.js

@@ -2903,8 +2903,6 @@ function createCoderWorkspace(settings) {
   return {
     specificationVersion: "harness-sandbox-v1",
     providerId: CODER_WORKSPACE_PROVIDER_ID,
-    // `bridgePorts` intentionally left undefined: this provider binds one
-    // workspace per session rather than leasing ports from a shared sandbox.
     createSession: async (options) => {
       const workspace = resolveWorkspace(options?.sessionId);
       const { session, createdByProvider } = await buildSession(workspace, options?.abortSignal);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coder/ai-sdk-sandbox",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Coder workspace sandbox provider for the Vercel AI SDK v7 HarnessAgent",
   "keywords": [
     "ai-sdk",
@@ -45,19 +45,19 @@
     "yaml": "^2.9.0"
   },
   "devDependencies": {
-    "@ai-sdk/harness": "^1.0.73",
-    "@ai-sdk/harness-claude-code": "^1.0.76",
-    "@ai-sdk/provider-utils": "^5.0.27",
-    "@ai-sdk/tui": "^1.0.67",
+    "@ai-sdk/harness": "^1.0.87",
+    "@ai-sdk/harness-claude-code": "^1.0.90",
+    "@ai-sdk/provider-utils": "^5.0.30",
+    "@ai-sdk/tui": "^1.0.80",
     "@arethetypeswrong/cli": "^0.18.5",
     "@types/node": "^26.2.0",
     "@types/ws": "^8.18.1",
-    "@vitest/coverage-v8": "^4.1.10",
-    "publint": "^0.3.23",
+    "@vitest/coverage-v8": "^4.1.11",
+    "publint": "^0.3.24",
     "tsup": "^8.5.1",
     "tsx": "^4.23.12",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10",
+    "vitest": "^4.1.11",
     "zod": "4.4.3"
   },
   "peerDependencies": {